Concept paper on the Bitkom Transfer Impact Assessment Tool (BiTIAT)

The Bitkom Transfer Impact Assessment Tool (BiTIAT) allows a structured assessment of international data transfers. The transfer of personal data based on the EU standard data protection clauses (also known as standard contractual clauses, SCC) and taking into account the so-called Schrems II decision requires an assessment of the specific circumstances of the transfer as well as the relevant legal provisions and customs of the third country of destination. This assessment is also called a Transfer Impact Assessment (TIA). Bitkom's Data Protection Working Group has bundled its expertise in a systematic approach to support such a TIA and transferred it to a tool (the BiTIAT).

The legal situation brought about by the ruling of the European Court of Justice ("ECJ") of July 16, 2020, Case No. C-311/18 ("Schrems II ruling") has long led to perplexity and uncertainty within the industry about how to deal with international data transfers. The uncertainty relates less to the directly implementable aspect of the ineffectiveness of the Privacy Shield adequacy decision. Rather, it concerns the more subtle consequences for international data transfers in general. For according to the judgment, even in the case of the use of standard contractual clauses within the meaning of Art. 46(2)(d) GDPR, there are more far-reaching examination requirements both on the part of the companies and on the part of the supervisory authorities on the question of the need for additional measures in favor of the protection of the rights and freedoms of data subjects in the case of third-country transfers.

The ECJ does not make any clear statements on the subsequent questions regarding the triggers for the necessity of additional measures as well as on the nature of the measures themselves, so that this vacuum must be filled by practice. The existing vacuum is unacceptable from the point of view of the member companies represented by Bitkom, because there is a lack of legal and planning certainty. 

Bitkom has therefore been addressing this challenge since August 2020 as part of a working group, and in the process has developed a concept for structured auditing as well as a supporting tool.

The tool, the underlying logics and components, and the relevant test steps are explained in the concept paper freely available here. The tool itself is reserved for Bitkom members. Further information and the login to the tool can be found on our BiTIAT project page.

You can download the paper here (german version).